CVE-2026-59192: TwigView: Deserialization of Untrusted Data

Q: Which deployments need to be updated?

Deployments using composer/jasny/twig-view versions earlier than 1.3.3 or 2.1.2 should update to the applicable fixed release.

Q: What must an attacker be able to do to exploit this issue?

An attacker needs untrusted serialized data to be processed by the plugin's unserialize filter. The vulnerable filter does not restrict which classes may be deserialized.

Q: What is the potential impact?

The unrestricted deserialization behavior can be used as a remote-code-execution gadget.

Q: How can I determine whether an installation is affected?

Check the installed version of composer/jasny/twig-view. Versions prior to 1.3.3 and 2.1.2 are affected; those fixed versions contain the patch.

Published Nov 11, 2026

Updated

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2.

Affected Software

1 affected component

composer/jasny/twig-view<1.3.3, <2.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TwigView plugin for CakePHP to a version that resolves this vulnerability.
Fixed in 1.3.3
Upgrade
Upgrade TwigView plugin for CakePHP to a version that resolves this vulnerability.
Fixed in 2.1.2

Event History

Nov 11, 2026

CVE Published

via MITRE·04:22 AM

Data Sourced

via MITRE·04:22 AM

DescriptionWeakness

Data Sourced

via NVD·05:19 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments need to be updated?

Deployments using composer/jasny/twig-view versions earlier than 1.3.3 or 2.1.2 should update to the applicable fixed release.

What must an attacker be able to do to exploit this issue?

An attacker needs untrusted serialized data to be processed by the plugin's unserialize filter. The vulnerable filter does not restrict which classes may be deserialized.

What is the potential impact?

The unrestricted deserialization behavior can be used as a remote-code-execution gadget.

How can I determine whether an installation is affected?

Check the installed version of composer/jasny/twig-view. Versions prior to 1.3.3 and 2.1.2 are affected; those fixed versions contain the patch.

CVE-2026-59192: TwigView: Deserialization of Untrusted Data

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments need to be updated?

What must an attacker be able to do to exploit this issue?

What is the potential impact?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments need to be updated?

What must an attacker be able to do to exploit this issue?

What is the potential impact?

How can I determine whether an installation is affected?